metamskextensionn[.]vercel[.]app

This domain, metamskextensionn.vercel.app, is identified as a high-risk brand impersonation site specifically targeting MetaMask, a widely used cryptocurrency wallet. Analysis indicates the site mimics the official MetaMask extension page, presenting itself as a secure Web3 crypto wallet for browsers. The threat type aligns with brand impersonation, likely designed to deceive users into entering sensitive credentials or downloading malicious software, potentially leading to unauthorized access or asset theft. No explicit drainer kit signatures were observed in initial scans, but the infrastructure supports credential harvesting operations typical of such campaigns. Infrastructure analysis reveals the following technical indicators: the domain is registered through Vercel Inc. and resolves to the IP address 216.198.79.67, located in the United States under AS16509 (Amazon.com, Inc.). The SSL certificate is issued by Google Trust Services (WR1), a common configuration for legitimate and malicious sites alike. VirusTotal detection metrics show 10 out of 95 security vendors flagging the domain as malicious. The domain appears on at least one security blocklist and is actively blocked by PhishDestroy. No Google Safe Browsing (GSB) status was explicitly provided, but the domain's presence on multiple threat intelligence feeds corroborates its malicious classification. Creation date data is not available, but the active status and recent detections suggest recent deployment. Current status confirms the domain remains active, posing an ongoing risk to users. Immediate response actions should include widespread blocklisting, takedown requests to the hosting provider (Vercel Inc.), and public advisories to MetaMask users. Despite existing detections, the domain's persistence on a major cloud provider's infrastructure indicates potential evasion tactics or delayed enforcement. Users are advised to verify the authenticity of any MetaMask-related sites by cross-referencing official domains and avoiding interaction with unverified extensions or download links. Organizations should monitor for related indicators of compromise, including the IP address and SSL certificate issuer, to prevent further exploitation.